Call of Duty Trojan horse creator ends up in jail, after drunken college raid

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

A British man who spread a spyware Trojan horse posing as a patch for the popular video game "Call of Duty", has ended up with an 18 month jail sentence.

According to local media reports, 20-year-old Lewys Martin of Deal, Kent, distributed a Trojan horse amongst game players, which logged keystrokes and stole bank details, credit card numbers and internet passwords - including PayPal credentials - from innocent computer users.

After selling the stolen details to other cybercriminals for between $1 to $5 a time, Martyn moved his ill-gained profits to an offshore account in Costa Rica.

Bizarrely, Martin's activities were only uncovered after he was caught drunkenly attempting to break into local colleges to steal computer equipment, Kent Online reports.

Police who raided Martin's home, found printouts of stolen credit card numbers and details of a fraudulent bank loan.

Last November, Martin had his sentence deferred by Canterbury Crown Court to allow him to attend a university computer course, and he was put on bail.

But it seems that Martin couldn't put his burglary habit behind him, and in March this year he broke his bail conditions by breaking into the Walmer Science College in Deal, causing hundreds of pounds of financial damage, and attempting to steal a computer, hard drive, walkie-talkies and other equipment.

Now he has been jailed for 18 months for three burglary and fraud charges and asking for another five to be taken into consideration.

Prosecutor Edmund Burge said it was unclear how much money Martin had made from his criminal activities, because the funds were held offshore:

"We don’t know how much money he got through selling the card details because the money is in a bank which won’t co-operate with the authorities. But Martin admitted to police that it was in the thousands of pounds."

Although Martin's defence lawyer pleaded for leniency, and the opportunity for Martin to complete his university course, the court appeared to have run out of patience with the young computer enthusiast and jailed him for 18 months.

The authorities are understood to be attempting to recover the money that Martin made through his cybercriminal activities.

Game players would be wise to pay attention to the technique used by Lewys Martin to infect computers. It's not uncommon for malware to be distributed in the form of cracks and hacks for popular computer games - if you run unknown code on your computer to meddle with a video game, you might well be allowing malware to insidiously install itself too.

Follow @gcluley

View the original article here

Election hacked, drunken robot elected to school board - Register

RSA 2012 Security experts have warned that electronic voting systems are decades away from being secure, and to prove it a team from the University of Michigan successfully got the foul-mouthed, drunken Futurama robot Bender elected to head of a school board.

In 2010 the Washington DC election board announced it had set up an e-voting system for absentee ballots and was planning to use it in an election. However, to test the system, it invited the security community and members of the public to try and hack it three weeks before the election.

"It was too good an opportunity to pass up," explained Professor Alex Halderman from the University of Michigan. "How often do you get the chance to hack a government network without the possibility of going to jail?"

With the help of two graduate students, Halderman started to examine the software. Despite it being a relatively clean Ruby on Rails build, they spotted a shell injection vulnerability within a few hours. They figured out a way of writing output to the images directory on the compromised server, and of encrypting traffic so that the front-end intrusion detection system couldn't spot them. The team also managed to guess the login details for the terminal server used by the voting system. This wasn't exactly difficult, since the user name and password were both "admin".

Once in, the team searched the government servers for additional vulnerabilities and system options. They found that the cameras installed to watch the voting systems weren't protected, and used them to work out when staff left for the day and so wouldn't spot server activity. More worrying, they also found a PDF file containing the authentication codes for every Washington DC voter in the forthcoming election.

The team altered all the ballots on the system to vote for none of the nominated candidates. They then wrote in names of fictional IT systems as candidates, including Skynet and (Halderman's personal favorite) Bender for head of the DC school board. They also set up systems so that any further ballots would come under their control.

According to the log files the team found, plenty of people were also busy trying to get into the system. They spotted attempts to get in from the Persian University, as well as India and China. Using their inside access, they blocked these attacks. Finally, they inserted the word "owned" onto the final signoff screen of the voting page, and set up the University of Michigan football fight song to play after 15 seconds.

It took two days before the authorities discovered they'd been pwned, and they were only alerted to that fact when another tester told them the system was secure, but that they should lose the music on the sign-off screen, as it was rather annoying. Halderman has now published a full account of the attack.

The attack demonstrates several of the flaws in electronic voting systems, and at numerous sessions at the RSA 2012 conference in San Francisco, experts have consistently warned against the dangers of this technology. In the US, there are 33 states that have introduced some kind of electronic voting systems – and none of them are secure enough to resist a determined attacker said Dr. David Jefferson from Lawrence Livermore National Labs.

"The states are in the habit of certifying voting systems, typically without testing them or seeing the source code," he said. "In many cases the voting system uses proprietary code that government can't legally check, and the running of the systems is outsourced to the vendors. This situation is getting worse."

E-voting was a national security issue, he said. Financial attacks by hackers are relatively easy to detect – because at some point money has to leave the system. But if an election is hacked then we may never know, because it's a one-time action that typically isn't checked after the results have been announced and officials elected.

It will be decades before we have the technology to vote securely, Jefferson said, if indeed it is even possible. At stake is democracy itself, but politicians don't seem to understand the problems of electronic voting, and both Jefferson and Halderman expressed fears for the future if current systems become more popular. ®

View the original article here